CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2013-2048
https://notcve.org/view.php?id=CVE-2013-2048
ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via unspecified vectors. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary API commands. ownCloud anterior a 5.0.6 no comprueba debidamente permisos, lo que permite a usuarios remotos autenticados ejecutar comandos API arbitrarios a través de vectores no especificados. NOTA: esto puede ser aprovechado mediante el uso de CSRF para permitir a atacantes remotos ejecutar comandos API arbitrarios. • http://owncloud.org/about/security/advisories/oC-SA-2013-025 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 25EXPL: 0CVE-2013-1850
https://notcve.org/view.php?id=CVE-2013-1850
Multiple incomplete blacklist vulnerabilities in (1) import.php and (2) ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file. Múltiples vulnerabilidades de lista negra incompleta en (1) import.php y (2) ajax/uploadimport.php en apps/contacts/ en ownCloud anterior a 4.0.13 y 4.5.x anterior a 4.5.8 permiten a usuarios remotos autenticados ejecutar código PHP arbitrario mediante la subida de un archivo .htaccess. • http://owncloud.org/about/security/advisories/oC-SA-2013-009 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 3.5EPSS: 0%CPEs: 23EXPL: 0CVE-2013-0297
https://notcve.org/view.php?id=CVE-2013-0297
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) site_name or (2) site_url parameter to apps/external/ajax/setsites.php. Múltiples vulnerabilidades de XSS en ownCloud anterior a 4.0.12 y 4.5.x anterior a 4.5.7 permiten a administradores remotos autenticados inyectar script Web o HTML arbitrarios a través del parámetro (1) site_name o (2) site_url hacia apps/external/ajax/setsites.php. • http://owncloud.org/about/security/advisories/oC-SA-2013-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 23EXPL: 0CVE-2013-0307
https://notcve.org/view.php?id=CVE-2013-0307
Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via the group input field parameter. Vulnerabilidad de XSS en settings.php en ownCloud anterior a 4.0.12 y 4.5.x anterior a 4.5.7 permite a administradores remotos inyectar script Web o HTML arbitrarios a través del parámetro del campo de entrada group. • http://owncloud.org/about/security/advisories/oC-SA-2013-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2013-0298
https://notcve.org/view.php?id=CVE-2013-0298
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted iCalendar file to the calendar application, the (2) dir or (3) file parameter to apps/files_pdfviewer/viewer.php, or the (4) mountpoint parameter to /apps/files_external/addMountPoint.php. Múltiples vulnerabilidades de XSS en ownCloud 4.5.x anterior a 4.5.7 permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través de (1) un archivo iCalendar manipulado hacia la aplicación calendar, el parámetro (2) dir o (3) file hacia apps/files_pdfviewer/viewer.php o el (4) parámetro mountpoint hacia /apps/files_external/addMountPoint.php. • http://owncloud.org/about/security/advisories/oC-SA-2013-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •